The Sandbox (SAND) Hack: Unbacked Tokens Minted on Base and BSC, Followed by Trading Caution Designation
이 포스팅은 쿠팡 파트너스 활동의 일환으로, 이에 따른 일정액의 수수료를 제공받습니다.
The Sandbox announced that a vulnerability in the 2026-08-22 SAND cross-chain bridge allowed an attacker to mint unbacked SAND on Base and BNB Smart Chain (BSC). The project said it had contained the issue and suspended bridging on both networks, but in South Korea, August 24 Sandbox (SAND) was subsequently designated as a trading caution asset.
The information in this article was verified as of 2026-08-24 at 7:25 p.m. Korea Standard Time. The most important point is that it would be inaccurate to assume that all SAND tokens were compromised in the same way. According to The Sandbox, the incident directly affected the SAND cross-chain bridge on Base and BSC. The project stated that SAND on Ethereum and Polygon, as well as user wallets, were not affected. However, South Korean exchanges have determined that the security incident has not yet been fully resolved, meaning users must separately check the trading status of their holdings.
What Actually Happened in the Sandbox Coin Hack?
The key officially confirmed finding is that the attacker was able to mint SAND on Base and BSC without the required collateral backing the tokens. The Sandbox explained that after identifying the vulnerability in its SAND cross-chain bridge, it disabled bridging on both networks, blocking routes through which the affected SAND could be transferred elsewhere or redeemed through the official bridge.
A cross-chain bridge is infrastructure used to transfer assets between different blockchains. According to The Sandbox, bridged SAND is normally backed by SAND locked on Ethereum. In this incident, however, SAND was created on Base and BSC without the corresponding collateral.
During the early stages of the incident, on-chain security firms and various media outlets reported different quantities of minted tokens. However, the reported number of unbacked SAND tokens, their market-value equivalent, and the actual confirmed financial loss are not the same thing. In its official explanation, The Sandbox stated that the incident affected less than 0.01% of the total SAND supply. The project also said it would publish a separate detailed incident report and technical post-mortem covering the precise technical circumstances and the final extent of the damage.
Therefore, claims that billions of tokens were minted and that an equivalent amount was actually stolen, or that a particular dollar figure represents the confirmed loss, are not supported by the official information currently available.
Is the SAND I Hold at Risk?
The first step is to identify which network holds your SAND. The Sandbox stated that SAND on Ethereum and Polygon was unaffected, user wallets were not compromised, and the assets locked on Ethereum to back bridged SAND remain intact.
The situation is different for SAND on Base or BSC. The project suspended bridging on both networks and explained that SAND liquidity on those networks had been compromised. It advised users not to buy, sell, or trade SAND on Base or BSC.
Rather than making a judgment simply because you hold SAND, it is more accurate to check the following points in order.
1. If you use a personal wallet, check which network holds your SAND: Ethereum, Polygon, Base, or BNB Smart Chain.
2. If your SAND is on Base or BSC, consult The Sandbox's subsequent announcements instead of attempting to bridge or trade the tokens independently.
3. If your SAND is held on a South Korean exchange, check that exchange's deposit and withdrawal suspension notices and trading caution announcements, separately from the status of personal wallets.
4. Do not connect your wallet through private messages or links claiming to offer official support. The Sandbox separately warned that its official team does not initiate private messages.
These four checks help distinguish between two different questions: whether your SAND has necessarily been stolen and whether transfers or trading are currently restricted.
Why Did South Korean Exchanges Suspend Deposits and Withdrawals?
Bithumb suspended SAND deposits and withdrawals beginning at 11:11 a.m. on August 22. Its announcement cited suspected security issues as the reason for the suspension and clarified that trading itself would remain available during the deposit and withdrawal suspension.
On the same day, Bithumb issued a separate cautionary notice stating that signs of abnormal token minting had been identified in The Sandbox's SAND smart contract on the Base chain. It also warned of the possibility of increased price volatility.
It is important to distinguish a deposit and withdrawal suspension from a trading suspension. A deposit and withdrawal suspension means that the ability to send SAND out of the exchange or transfer SAND into the exchange is restricted. In its August 22 announcement, Bithumb explicitly stated that trading would remain available during the suspension.
However, the situation progressed another step on August 24.
August 24 Trading Caution Designation: What Changed?
Bithumb newly designated Sandbox (SAND) as a trading caution asset on 2026-08-24. The stated reason was confirmation of a security incident, such as hacking, involving a virtual asset wallet or a distributed ledger used to issue, transfer, or store virtual assets, where the cause had not been identified or the issue had not been remedied.
Importantly, designation as a trading caution asset does not automatically mean that trading support will be terminated. Bithumb announced that the designation could be lifted if the underlying reasons were resolved.
As of August 24 at 7:25 p.m., the relevant announcement stated that SAND deposits and withdrawals remained suspended. A follow-up announcement concerning an extension or removal of the designation, or a possible termination of trading support, is scheduled for the first week of October, between September 28 and October 2. The schedule is subject to change.
The current situation is easier to understand when broken down chronologically.
August 22: Signs of abnormal SAND minting were identified on Base, and South Korean exchanges began restricting deposits and withdrawals and issuing cautionary notices.
After August 22: The Sandbox announced that it had contained the Base and BSC bridge issue and suspended bridging on both networks.
August 24: South Korean exchanges did not consider the issue fully resolved and took further action by designating Sandbox (SAND) as a trading caution asset.
The project's statement that it had contained the vulnerability and the exchange's decision to designate the asset for caution because the cause of the security incident remained unidentified or unresolved do not mean the same thing. The former describes the project's response to block the attack route, while the latter reflects the exchange's determination that additional verification is necessary from a trading-support perspective.
Why Was SAND Designated as a Trading Caution Asset If the Impact Was Less Than 0.01%?
The Sandbox's statement that the incident affected less than 0.01% of the total supply should not, by itself, be interpreted as proof that the security issue has been completely resolved. That figure describes the scope of the incident as reported by the project. South Korean exchanges determine whether to designate an asset for trading caution through a separate trading-support review and an assessment of whether the security incident has been resolved.
Three figures are particularly easy to confuse in this incident: the number of SAND tokens observed to have been minted during the attack, the nominal market value of those tokens, and the actual scope of the impact reported by the project. Treating these three figures as a single measure of financial damage can lead to substantially different conclusions.
What can currently be confirmed from official information is The Sandbox's statement that the incident affected less than 0.01% of the total supply. By contrast, it is difficult to draw definitive conclusions about the final confirmed loss, the complete sequence of the attack, or the scope of recovery before the detailed technical report is published.
Therefore, caution is needed both when assuming that the security incident has been resolved simply because of price movements and when calculating actual losses directly from the amount of tokens initially observed being minted on-chain.
Three Things to Watch Next
The first is The Sandbox's detailed incident report and technical post-mortem. The project stated that it was continuing to investigate the scope of the attack and would publish a separate report. Once released, the report may provide greater clarity about the precise extent of the vulnerability and the final assessment of the damage.
The second is whether bridging resumes on Base and BSC. According to the official information currently available, the bridges on both networks remain disabled, and SAND on Base and BSC remains isolated. The project also stated that it was preparing a compensation plan for eligible users of the affected liquidity pools.
The third is follow-up announcements from South Korean exchanges concerning the removal or extension of the trading caution designation or other trading-support decisions. For users holding SAND on an exchange, the status of domestic deposit and withdrawal services is just as important as developments on overseas blockchain networks. According to Bithumb's latest information, deposits and withdrawals remain suspended, and a follow-up decision regarding the trading caution designation is expected in the first week of October.
At this stage, the first priority for SAND holders is not to predict price movements but to check the network on which their tokens are held and the deposit and withdrawal status of the exchange they use. The Sandbox has advised users to refrain from trading SAND on Base and BSC, while users of South Korean exchanges should also monitor the trading caution designation and subsequent announcements. The final scale of the damage and the complete technical cause of the incident should be assessed separately once the detailed post-mortem report becomes available.
※ This article is provided for informational purposes to help readers understand market developments and does not constitute an investment recommendation for any particular security or asset. All final investment decisions and associated responsibilities rest with the individual investor.
Related Articles
Trump Delays Additional 50% Tariffs on Canada by 3 Days, Postponing Implementation to August 22
이 포스팅은 쿠팡 파트너스 활동의 일환으로, 이에 따른 일정액의 수수료를 제공받습니다.